CVE-2026-5713: Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target
Last updated 6 July 2026
Other sources
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5713?
CVE-2026-5713 has been classified as a high severity vulnerability due to the potential for out-of-bounds read/write operations.
How do I fix CVE-2026-5713?
To fix CVE-2026-5713, update to the latest version of Python that addresses this specific vulnerability.
What software versions are affected by CVE-2026-5713?
CVE-2026-5713 affects Python versions 3.14 and above, specifically 3.15 and newer.
What are the implications of CVE-2026-5713?
The implications of CVE-2026-5713 include potential security risks when profiling and inspecting asyncio processes connected to untrusted sources.
Can CVE-2026-5713 be exploited remotely?
Yes, CVE-2026-5713 can be exploited remotely when connecting to a malicious target using the affected Python profiling features.